From e181132921242fab5195c6a91ed1cf98bef28af2 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 9 Jun 2026 01:51:42 +0700 Subject: [PATCH] PR revamp modifications --- ...images.yml => 4_build_and_push_images.yml} | 6 +- .../workflows/{push.yml => 4_pr_check.yml} | 11 ++- .github/workflows/trivy-dashboard.yml | 76 ------------------- .github/workflows/trivy-indexer.yml | 76 ------------------- .github/workflows/trivy-manager.yml | 76 ------------------- 5 files changed, 12 insertions(+), 233 deletions(-) rename .github/workflows/{Procedure_push_docker_images.yml => 4_build_and_push_images.yml} (98%) rename .github/workflows/{push.yml => 4_pr_check.yml} (98%) delete mode 100644 .github/workflows/trivy-dashboard.yml delete mode 100644 .github/workflows/trivy-indexer.yml delete mode 100644 .github/workflows/trivy-manager.yml diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/4_build_and_push_images.yml similarity index 98% rename from .github/workflows/Procedure_push_docker_images.yml rename to .github/workflows/4_build_and_push_images.yml index 3dc541f2..afef0da3 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/4_build_and_push_images.yml @@ -1,5 +1,5 @@ -run-name: Launch Push Docker Images - ${{ inputs.id }} -name: Push Docker Images +run-name: Build and push images 4.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }} +name: Build and push images 4.x on: workflow_dispatch: @@ -92,7 +92,7 @@ jobs: - name: Print inputs run: | echo "---------------------------------------------" - echo "Running Procedure_push_docker_images workflow" + echo "Running 4_build_and_push_images workflow" echo "---------------------------------------------" echo "* BRANCH: ${{ github.ref }}" echo "* COMMIT: ${{ github.sha }}" diff --git a/.github/workflows/push.yml b/.github/workflows/4_pr_check.yml similarity index 98% rename from .github/workflows/push.yml rename to .github/workflows/4_pr_check.yml index 684a4ec5..a7b7f344 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/4_pr_check.yml @@ -1,6 +1,13 @@ -name: Wazuh Docker pipeline +name: Wazuh Docker pipeline 4.x -on: [pull_request] +on: + pull_request: + paths: + - 'build-docker-images/**' + - 'multi-node/**' + - 'single-node/**' + - 'wazuh-agent/**' + - '.github/**' jobs: build-docker-images: diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml deleted file mode 100644 index f4731b21..00000000 --- a/.github/workflows/trivy-dashboard.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh dashboard - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh dashboard - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-dashboard.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-dashboard.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml deleted file mode 100644 index bad0abef..00000000 --- a/.github/workflows/trivy-indexer.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh indexer - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh indexer - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-indexer.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-indexer.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml deleted file mode 100644 index 609f36ac..00000000 --- a/.github/workflows/trivy-manager.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh manager - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh manager - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-manager.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-manager.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file